Ransomware is malware that encrypts or locks computer files, and then demands payment of a “ransom” to decrypt or unlock them. There is no guarantee that paying the ransom will regain access and victims of ransomware can be subject to multiple attacks if they are not protected. Ransomware encryption can be at military grade leaving it nearly impossible to break. Furthermore, ransomware often operates to obfuscate the identity of the actual source file causing the ransomware attack. For example, ransomware attacks can use existing device processes and threads to hide. Ransomware threads can also inject themselves into other processes or ransomware threads can start processes and then inject threads into the processes. Thus ransomware is traditionally very difficult to detect, stop, and remediate.